Configure
Agent authentication
Keep agent login, model access, speech keys, the Discord token, and call links separate.
Which credential does what?
| Credential | Purpose | Where it lives |
|---|---|---|
| Agent login | Authenticates the selected agent through its own supported login method. | The agent's own login, outside Sleeptalk |
| Model credential | Lets the selected model endpoint run inference. Used by Just a model profiles and the protected Hermes path. | Sleeptalk's private store, referenced from the profile |
| Speech key | Lets one speech service listen and speak. | Sleeptalk's private store, referenced from the profile |
| Discord bot token | Authenticates the bot to Discord. | Sleeptalk's private store, referenced from the profile |
| Agent gateway tokens | Tokens for a Hermes dashboard, OpenClaw, or your own agent. | Sleeptalk's private store, referenced from the profile. An older copy in .env still works and moves to the store the next time you save that profile's agent. |
| Call link | Grants bounded access to one call. It is not a provider key. | Nowhere; it is single use |
A speech key never grants agent or model access, and a model key is not a speech key. The exception is a key your agent already uses for OpenRouter, Venice, Groq, or Together: that service can also listen and speak, so Sleeptalk can offer to reuse the key for speech. See speech providers.
Check the selected adapter
An installed agent program does not prove its account, model, workspace, or tool permissions are ready. Read the adapter's readiness message and the onboarding coverage for your agent.
Private onboarding covers specific configurations of Codex, Claude Code, Pi, oh-my-pi, Cursor, and protected Hermes. The supported login methods differ. For example, a native API-key probe does not establish support for that adapter's custom gateway path. Subscription logins are never used.
Sleeptalk uses the Hermes you have installed, over ACP, by default. The pinned, isolated Hermes runtime is opt-in. Its protected bridge uses explicit pending or deny tool policy and excludes existing-session restoration, ambient plugins, MCP, and delegation. See Hermes.
Select or change the agent on the settings page with sleeptalk settings. Complete its own login on the runtime host when required. Use sleeptalk settings --terminal for the terminal wizard.
Private model entry
sleeptalk host auth start, host auth status, and host auth cancel handle model credentials privately. You open the page and enter the value. The agent reads only a receipt that contains a reference.
sleeptalk host auth start --request-id <id> --mode api_key \
--protocol openai-completions --base-url https://example.com/v1 --model <model>--mode is api_key; subscription logins are refused. --protocol is one of openai-completions, openai-responses, openai-codex-responses, anthropic-messages, or cursor. openai-codex-responses is listed but refused: it is the ChatGPT subscription route. Pass the returned reference to sleeptalk host input link with --agent-credential-ref, together with the matching --agent-auth-mode, --agent-auth-protocol, and --agent-auth-url.
Keep the mode, protocol, endpoint, model, and reference together through setup and runtime probing. Changing one is a new credential scope, not a cosmetic edit.
The protected Hermes path accepts documented native API keys and compatible custom endpoints. Just a model accepts an API key or a supported local endpoint. These are separate contracts.
Expiry and custom endpoints
Private model entry accepts an API key that was already issued. It does not take subscription logins (Claude, ChatGPT or Codex, Cursor), run a login flow, or refresh an expired token. Replace an expired credential privately, then check the runtime again.
For a custom endpoint, check the exact destination before entering a key. A public model list is not evidence that a key works, and successful metadata access does not guarantee inference access or quota.
Provider sign-up, account recovery, MFA, and billing stay with you. An agent never asks for a key in chat.